Wellhead flowline protection system

ABSTRACT

A system and method for the application of differential pressure indicating transmitters in conjunction with pressure sensors, pressure transmitters and position switches to monitor and control the flowline protection systems at remote wellheads. The system communicates with a local control panel in proximity to the wellhead, as well as to a central control room at the processing plant supplied by the wells. The system provides a black box data recorder function that documents every system test, valve closure, and the ability of the independent protection layers to contain the wellhead topside pressure. In addition, the system provides a means to limit release of hydrocarbons via a conventional pressure relief and flare system, and documents high pressure events when pressure relief valve setpoints are reached.

FIELD OF THE INVENTION

The present invention relates to a system and method for the application of differential pressure indicating transmitters in conjunction with pressure sensors, pressure transmitters and position switches to monitor and control a flowline protection system (FPS) at a remote wellhead. The system communicates with a local control panel in proximity to the wellhead, as well as to a central control room at the processing plant supplied by the well. The system provides a “black box” data recorder function that documents every system test, valve closure and ability of independent protection layers to contain the well topside pressure.

BACKGROUND OF THE INVENTION

In the oil and gas industry, production fluid pipelines downstream of the wellhead are designed to minimize the cost of the pipeline and the cost of a conventional downstream pressure relief valve and flare system. It is therefore necessary that such pipelines be protected against excessive pressure that might rupture the pipe or lift pressure relief devices, which could result in excess flaring or environmental pollution. A design approach used to protect pipelines from over-pressure applies a short-section of thick-walled pipe close to the wellhead, with a dual layer of protection comprising an emergency shutdown (ESD) valve and a high integrity protection system (HIPS). The ESD valve is designed to provide a safe and orderly shutdown of the pipeline in the event process parameters require it. HIPS is typically an automated electro-hydraulic system employing pressure sensors to control the closure of valves to isolate a rapid build-up of pressure in order to protect the downstream pipe from an overpressure which may exceed the pipeline's pressure rating. A HIPS unit is preferably provided with standardized design and integrally constructed as a modular, factory-assembled unit.

Prior art valve control techniques rely upon valve limit switches or valve stem position sensors to offer feedback during functional valve testing of the ESD valve and the HIPS valves. In some cases, differential pressure is also checked to confirm valve closure. However, the prior art does not disclose the use of differential pressure measurements across each of the safety systems independent protection layers within an assembled flowline protection system to provide useful and actional feedback of the status of each of the systems and to identify failures.

It would be desirable to provide a wellhead flowline protection system that includes differential pressure transmitters across each of the safety systems independent protection layer and that incorporates those measurements within expert, state-based logic, local to the wellsite.

It is therefore an object of the present invention to provide a wellhead flowline protection system and a method for the application of differential pressure indicating transmitters in conjunction with pressure sensors, pressure transmitters and position switches to monitor and control the integrated protection systems at remote wellheads.

SUMMARY OF THE INVENTION

The above objects, as well as other advantages described below, are achieved by the method and apparatus of the invention which provides a flowline protection system comprising an emergency shutdown valve and a high integrity protection system (HIPS). The ESD valve is designed to provide a safe and orderly shutdown of the pipeline in the event process parameters require it. The HIPS offers an additional layer of protection to limit pressure exerted on the piping system connected to a wellhead. The HIPS of the present invention has an inlet for connection to the wellhead and an outlet for connection to the downstream piping system and, in a preferred embodiment, is constructed as a skid-mounted integral system for transportation to the site where it is to be installed.

The ESD valve is monitored by a valve stem position switch, a downstream pressure switch, and an upstream pressure indicating transmitter, with a differential pressure indicating transmitter measuring differential pressure across the ESD valve. The instruments provide their measurements to a local control panel located at the wellsite. The HIPS comprises at least one set of two valves in series, each valve monitored by a valve stem position switch, and at least one dedicated set of redundant pressure switches located downstream of the valves and by an additional pressure indicating transmitter. In addition, a differential pressure indicating transmitter is placed across each of the HIPS valves, and another differential pressure indicating transmitter is placed across each of the at least one set of two valves that make up the assembled HIPS unit. These instruments also provide their measurements to the local control panel located at the wellsite. The local control panel provides a wellsite “black box” data recorder function that documents and time stamps valve movement and system performance.

BRIEF DESCRIPTION OF THE DRAWINGS

The present invention will be further described below and in conjunction with the accompanying drawings in which:

FIG. 1 is a schematic diagram of a wellhead flowline protection system in accordance with the invention; and

FIG. 2 is a process flow diagram of steps carried out in monitoring and controlling a wellhead flowline protection system, using the system and method of the present invention; and

FIG. 3 is a block diagram of a component of a system for implementing the invention, according to one preferred embodiment of the present invention.

DETAILED DESCRIPTION OF THE INVENTION

Referring to FIG. 1, a flowline protection system 1 is installed at a petroleum wellhead 2 to protect the integrity of flowline 3, prevent the loss of petroleum product and prevent environmental damage, as well as reducing the occurrence of activation (lifting) of conventional pressure relief systems. Flowline protection system (FPS) 1 comprises an emergency shutdown (ESD) system 4, a high integrity protection system (HIPS) 5, and local control panel 10.

ESD 4 includes an ESD valve 20, monitored by position switch 30, a pressure transmitter 40 that is tapped from flowline 3 downstream of valve 20, and a differential pressure indicating transmitter 50 that is placed across valve 20. The instrumentation interfaces with local control panel 10. The actuator for valve 20 is not shown, but also interfaces with local control panel 10.

HIPS 5 includes redundant inline valves 21 and 22, each monitored by a valve stem position switch, 31 and 32, respectively. Redundant pressure transmitters 41, 42 are tapped from flowline 3 downstream of valves 21 and 22. Differential pressure indicating transmitters 51 and 52 are placed across valves 21 and 22, respectively, and differential pressure indicating transmitter 53 is placed across both valves 21 and 22. The instrumentation interfaces with local control panel 10. The actuators for valves 21 and 22 are not shown, but also interface with local control panel 10.

ESD 4 is placed upstream of HIPS 5. ESD 4 has a lower trip setting than HIPS 5. Pressure indicating transmitter 60 is tapped off flowline 3 upstream of ESD 4, while pressure indicating transmitter 61 is tapped off flowline 3 downstream of HIPS 5. Pressure indicating transmitters 60, 61 also interface with local control panel 10. A specification break 6 is placed in flowline 3 downstream of HIPS 5, at a junction between high-pressure upstream piping and lower-pressure downstream piping.

Downstream of specification break 6 is a conventional pressure relief and flare system 7. Pressure relief and flare system 7 includes a pressure relief valve that will have a setpoint above that of FPS 1. That is, ESD 4 and HIPS 5 will activate before pressure relief and flare system 7 activates.

During normal operation, all valves 20, 21, 22 will be open and position switches 30, 31, 32 will correctly identify that. Pressure transmitters 40, 41, and 42 will all indicate a consistent normal pressure, such as 500 psig, and the differential pressure indicating transmitters 50, 51, 52, 53 will indicate 0 psig (i.e., no difference between the upstream and downstream pressures they are monitoring). Local control panel 10 will indicate safe and normal operation.

In the event of an overpressure at the well due to downstream blockage, the ESD system should trip first on increasing pressure, as it has a lower trip setting than the FPS. If it trips, then ESD valve 20 should close, which should be indicated by valve stem position switch 30. Pressure transmitter 40 will indicate the pressure downstream of valve 20, and differential pressure indicating transmitter 50 shall indicate the pressure difference between the upstream and downstream sides of valve 20. If valve 20 correctly trips and closes, the downstream flowline 3 shall be pressurized at a level below the HIPS or the pressure relief valve setpoint. The differential pressure indicating transmitter 50 will indicate a differential of the wellhead shut-in pressure and the downstream flowline pressure. Local control panel 10 will indicate trip of ESD 4, that it requires reset, and will record the time and date of the event.

If ESD 4 fails to trip in response to an overpressure, such as 800 psig, then the pressure will rise until the blockage results in a HIPS 5 trip, which will close valves 21 and 22, and which closure will be indicated by position switches 31, 32. Pressure transmitters 41, 42 will indicate the pressure downstream of valves 21, 22, and differential pressure indicating transmitters 51, 52, 53 will indicate the pressure difference each is experiencing. If valve 21 correctly closes, then pressure transmitters 41, 42 will indicate the pressure within the downstream flowline 3, differential pressure indicating transmitter 51 (across valve 21) will indicate a differential of the wellhead shut-in pressure and the pressure of downstream flowline 3. Differential pressure indicating transmitter 52 (across valve 22) will not indicate any differential pressure, as the upstream overpressure will be sealed off by valve 21. Differential pressure indicating transmitter 53 (across both valves 21 and 22) will indicate a differential of the wellhead shut-in pressure and the pressure of downstream flowline 3. If valve 21 fails to close but valve 22 does close, then differential pressure indicating transmitter 51 would not indicate a differential, but differential pressure indicating transmitter 52 would indicate the full differential, as would differential pressure indicating transmitter 53. In either case, local control panel 10 will indicate failure of ESD 4 to trip, will indicate that HIPS 5 has tripped and requires reset, and will record the date and time of all valve responses. There can also be cases where the downstream pressure exceeds the pressure setpoints of ESD 4 and HIPS 5 for a short period that reaches the downstream pressure relief valve lift setting. This does not change the operation of the ESD or HIPS layers of protection.

The black box function of local control panel 10 tracks the maximum upstream to downstream pressure rise during a high pressure event.

In the event of an overpressure in the downstream piping, followed by failure of both ESD 4 and HIPS 5, the pressure indicating transmitters 60, 61 would both indicate the pressure relief valve setting, and the differential pressure indicating transmitters 50, 51, 52, 53 would not indicate any differential. Local control panel 10 would indicate a failure of ESD 4 and HIPS 5, and that manual isolation of wellhead 2 is required. Local control panel 10 would also timestamp occurrences of downstream pressure exceeding the setting of pressure relief and flare system 7, so as to document the venting of the well.

In an alternate embodiment, not shown, HIPS 5 can include two sets of redundant inline valves, the two sets being assembled in parallel, such that for testing purposes one of the sets can be isolated and the valves closed while the other set of valves remains open to allow uninterrupted flow from the wellhead. All valves within the parallel flow paths would be monitored by local control panel 10, as described above.

In another embodiment, local control panel 10 supports functional testing of ESD 4 and HIPS 5 systems. Furthermore, the black box functions of the local control panel include time stamping all ESD 4 and HIPS 5 valve movements, whether they occur as part of a functional test, or through a safety demand.

In another embodiment, local control panel 10 is configured to monitor for leaks in the flowline, emergency shutdown system, or high integrity protection system, and to timestamp and record any detected leaks, in support of a leak detection and repair reporting program.

FIG. 2 shows a process flow diagram of a method 200 of monitoring and controlling a wellhead flowline protection system. In step 205, local control panel 10 monitors normal conditions, confirming that position switches indicate that the ESD valve 20 and HIPS valves 21 and 22 are open, and confirming that the pressure switches, pressure transmitters, and differential pressure transmitters are reporting numbers that are within tolerance. If the conditions remain normal, method 200 advances to step 210, in which local control panel 10 indicates that conditions are normal, such as via a green pilot light on local control panel 10. As long as conditions remain normal, method 200 will continue to loop back through step 205.

If local control panel 10 notes an overpressure condition, method 200 advances to step 215, in which local control panel 10 signals for a trip of ESD valve 20. The method 200 advances to step 220, monitoring valve stem position switch 30, the pressure switches, pressure transmitters, and differential pressure transmitters to confirm that ESD valve 20 has tripped. If ESD valve 20 is confirmed as tripped, method 200 advances to step 225, in which local control panel 10 confirms the trip of ESD valve 20, such as via a red pilot light on local control panel 10. Method 200 then awaits a reset by an operator or maintenance personnel.

If a trip of ESD valve 20 is not confirmed, method 200 advances to step 230, in which local control panel 10 signals for a trip of HIPS valves 21 and 22. The method 200 advances to step 235, monitoring position switches 31, 32, the pressure switches, pressure transmitters, and differential pressure transmitters to confirm that at least one of HIPS valves 21 and 22 have tripped. If HIPS valve 21 or 22 is confirmed as tripped, method 200 advances to step 240, in which local control panel 10 confirms which HIPS valves have tripped, such as via red pilot lights on local control panel 10. Method 200 then awaits a reset by an operator or maintenance personnel.

If neither of HIPS valves 21 and 22 trip, method 200 advances to step 245, in which local control panel 10 indicates that the downstream pressure reached the pressure relief valve setting and that manual isolation is required.

If a reset is required as a result of steps 225, 240, or 245, this is accomplished by step 250. The method 200 will continue to loop back through step 250 until a reset is accomplished. When an operator or maintenance personnel conducts the appropriate actions, ensuring that the pressures are within tolerance, and all equipment and instrumentation is in working condition, the valves are reopened, and the system reset to step 205.

FIG. 3 shows an exemplary block diagram of a computer system 400 installed in local control panel 10. Computer system 400 includes a processor 420, such as a central processing unit, an input/output interface 430 and support circuitry 440. Optionally, a display 410 and an input device 450 such as a keyboard, mouse or pointer are also provided. The display 410, input device 450, processor 420, and support circuitry 440 are shown connected to a bus 490 which also connects to a memory 460. Memory 460 includes program storage memory 470 and data storage memory 480. Note that while computer 400 is depicted with direct human interface components display 410 and input device 450, programming of modules and exportation of data can alternatively be accomplished over the interface 430, for instance, where the computer 400 is connected to the central control room at the processing plant supplied by the wells, or via a detachable input device as is known with respect to interfacing programmable logic controllers.

Program storage memory 470 and data storage memory 480 can each comprise volatile (RAM) and non-volatile (ROM) memory units and can also comprise hard disk and backup storage capacity, and both program storage memory 470 and data storage memory 480 can be embodied in a single memory device or separated in plural memory devices. Program storage memory 470 stores software program modules and associated data, and in particular stores a first software program module 310 that monitors for normal pressure and calls for the trip of the ESD valve in the event of overpressure; a second software program module 320 that monitors whether the ESD valve has tripped when called to do so, and if not, that calls for the HIPS valves to trip; a third software program module 330 that monitors whether at least one of the HIPS valves have tripped when called to do so, and if not, signals that manual isolation is required; and a fourth software program module 340 that monitors for a manual reset of tripped valves. Software program modules 310-340 incorporate the logic recited above in the paragraphs that describe FIG. 1. Local control panel 10 includes black box data recorder functions, monitoring the performance of the well and associated ESD and HIPS systems.

In a preferred embodiment, support circuitry 440 of local control panel 10 includes a fully self-contained battery backup. The battery backup integrates with solar charging panel 445 that provides power at wellsites that are not supplied with utility power. Solar charging panel 445 is preferably mounted remotely from local control panel 10.

Thus, it can be seen that with this combination of isolation valves, position switches, pressure transmitters, pressure indicating transmitters, and differential pressure indicating transmitters, local control panel 10 will be able to recognize whether conditions are normal, or whether there is a high pressure demand with proper response by ESD 4, or whether there is a high pressure demand with a failure of ESD 4 but with a proper response by HIPS 5, or whether there is a high pressure demand with a failure of both ESD 4 and HIPS 5 that resulted in activation of pressure relief and flare system 7.

Another feature of the invention is that pressure indicating transmitter 61 works with local control panel 10 to identify the maximum pressure experienced by flowline 3 during a high pressure event, because even if the ESD and/or HIPS function as required at their setpoints, it is important to know the maximum downstream pressure reached to assess the likelihood of damage to flowline 3 downstream of specification break 6 and to determine if the pressure relief valve lifted, resulting in release of hydrocarbons.

The system and method can be used for new construction, or can be retrofitted to existing construction at wellsites with reliable power or at remote wellsites without a reliable power supply.

Although various embodiments that incorporate the teachings of the present invention have been illustrated in the figures and described in detail, other and varied embodiments will be apparent to those of ordinary skill in the art and the scope of the invention is to be determined by the claims that follow. 

We claim:
 1. An automated flowline protection system for protecting a flowline at an oil or gas wellhead, the flowline protection system comprising an emergency shutdown system, a high integrity protection system, and a local control panel; the emergency shutdown system comprising: an emergency shutdown valve installed downstream of the wellhead on a high pressure segment of the flowline; an emergency shutdown valve actuator; an emergency shutdown valve stem position switch that monitors the position of the emergency shutdown valve; a first pressure transmitter installed on the high pressure segment of the flowline between the wellhead and the emergency shutdown valve; a first pressure switch installed on the high pressure segment of the flowline downstream of the emergency shutdown valve and upstream of the high integrity protection system; and a first differential pressure indicator installed across the emergency shutdown valve; wherein the emergency shutdown valve actuator, the emergency shutdown valve position switch, the first pressure transmitter, the first pressure switch, and the first differential pressure indicator interface with the local control panel; and the high integrity protection system comprising: at least one set of a first and second inline valve installed in series on the high pressure segment of the flowline, downstream of the emergency shutdown system; a first inline valve actuator; a second inline valve acuator; a first and second inline valve stem position switch respectively monitoring the positions of the first and the second inline valves; a second pressure transmitter and a second and a third pressure switch installed downstream of the high integrity protection system and upstream of a spec break separating the high pressure segment of the flowline from a downstream lower pressure segment of the flowline; a second and a third differential pressure transmitter installed respectively across the first and the second inline valves; and a fourth differential pressure transmitter installed across the series installation of the first and the second inline valves; wherein the first and the second inline valve actuators, the first and the second inline valve position switches, the second pressure transmitter, the second and the third pressure switches, and the second, the third, and the fourth differential pressure indicators interface with the local control panel.
 2. The system of claim 1 in which the high pressure segment of the flowline is rated for a maximum operating pressure that corresponds to a maximum shut-in pressure of the wellhead.
 3. The system of claim 1, wherein the local control panel is configured such that in the event of an overpressure at the well as indicated by any of the first, second, or third pressure switches, the local control panel signals the emergency shutdown valve actuator to close the emergency shutdown valve and the local control panel monitors the emergency shutdown valve stem position switch, and monitors and records pressure to confirm that closure of the emergency shutdown valve has occurred, and if the local control panel determines that the emergency shutdown valve fails to close following the overpressure event, the local control panel signals the first and second inline valve actuators of the high integrity protection system to close the first and second inline valves, and the local control panel monitors the first and second inline valve position switches, and monitors and records pressure to confirm that closure of the first and second inline valves has occurred, and if the local control panel determines that neither of the inline valves closes following a failure of the emergency shutdown valve to close following the overpressure event, the local control panel signals that manual isolation of the flowline protection system is required.
 4. The system of claim 3, wherein: the local control panel includes a clock; records a timestamped record of all signals to the emergency shutdown valve actuator to close the emergency shutdown valve and timestamps all movements of the emergency shutdown valve as indicated by the emergency shutdown valve stem position switch; and records a timestamped record of all signals to the first and second inline valve actuators of the high integrity protection system to close the first and second inline valves, and timestamps all movements of the first and second inline valves as indicated by the first and second inline valve position switches.
 5. The system of claim 1, wherein the local control panel is programmed to perform functional testing of the emergency shutdown valve and the first and second inline valves of the high integrity protection system.
 6. The system of claim 5, wherein: the local control panel includes a clock; records a timestamped record of all functional testing signals to the emergency shutdown valve actuator to close the emergency shutdown valve and timestamps all movements of the emergency shutdown valve as indicated by the emergency shutdown valve stem position switch; and records a timestamped record of all functional testing signals to the first and second inline valve actuators of the high integrity protection system to close the first and second inline valves, and timestamps all movements of the first and second inline valves as indicated by the first and second inline valve position switches.
 7. The system of claim 1, wherein the local control panel includes a clock, and monitors, timestamps, and records maximum upstream to downstream pressure rise during a high pressure event.
 8. The system of claim 1, further comprising a pressure relief valve and flare system downstream of the spec break, wherein the local control panel includes a clock, and wherein the local control panel monitors, timestamps, and records flaring that occurs when any of the second pressure transmitter and the second and the third pressure switch installed downstream of the high integrity protection system and upstream of a spec break indicate a downstream pressure that exceeds the setting of the pressure relief valve and flare system.
 9. The system of claim 1, wherein the local control panel includes a clock, and wherein the local control panel is configured to monitor for leaks in the flowline, emergency shutdown system, or high integrity protection system, and to timestamp and record any detected leaks. 